Vox Pupuli Container Statistics

Hello everyone! I am excited to share some updates regarding container statistics. We now have a page where we display the statistics for all our containers. You can find it at https://voxpupuli.org/container_statistics/. It is built from https://github.com/voxpupuli/container_statistics and is updated every 24 hours. Getting the Downloads For the download count, it scrapes the package HTML pages for the containers. Sadly, this does not work with GraphQL or the API, so we have to use the HTML pages for now. GraphQL and the API do expose a download count, but it is only for GitHub's legacy container system and not for ghcr.io ¯\_(ツ)_/¯. If someone has an idea for a better way to get the download count from ghcr.io, please let me know. The API is not very talkative about this :/ Getting the CVEs For CVEs, we run two scanners: the wildly popular Trivy scanner and Grype from Anchore. Both are run against the latest version of each container, and the results are displayed on the statistics page. For Grype, we downplay the nvd/cpe entries, as they tend to be false positives. They are still displayed, but specifically marked as nvd/cpe entries, so you can filter them out if you want to. How the statistics are generated The statistics can be generated by running the bin/container-statistics script in the container_statistics repository. It needs a configuration file, which is located in the config directory. --- containers: - name: openvoxproject/openbolt registry: ghcr.io tags: - latest - name: openvoxproject/openvoxagent registry: ghcr.io tags: - latest We run it in GitHub Actions and push the results to the gh-pages branch, which is then displayed on the statistics page. Scanning is also done in GitHub Actions. The whole process is automated and runs every 24 hours, so the statistics are always up to date. See the GitHub Actions workflow in the container_statistics repository (.github/workflows/container-statistics.yml) for more details. You can run it locally and generate the statistics yourself. You will need to have the scanners installed and available in your path. CLI Commands bin/container-statistics --download-report This will display the downloads for all containers in a table format. This will live-scrape the HTML pages for the containers, so it might take a while to run. bin/container-statistics --download-report CONTAINER TOTAL DOWNLOADS ------------------------------------ --------------- ghcr.io/openvoxproject/openbolt 1,504 ghcr.io/openvoxproject/openvoxagent 11,814 ghcr.io/openvoxproject/openvoxdb 157,774 ghcr.io/openvoxproject/openvoxserver 151,344 ghcr.io/voxpupuli/commitlint 756 ghcr.io/voxpupuli/onceover 4,248 ghcr.io/voxpupuli/r10k-webhook 7,738 ghcr.io/voxpupuli/r10k 22,548 ghcr.io/voxpupuli/renovate 5,551 ghcr.io/voxpupuli/semantic-release 7,870 ghcr.io/voxpupuli/voxbox 131,841 bin/container-statistics --cve-report This will display the CVEs for all containers in a table format. It depends on the scanners being installed and having been run at least once, so that the results are available in the cache. bin/container-statistics --cve-report CONTAINER CRITICAL HIGH MEDIUM LOW UNKNOWN TOTAL -------------------------------------------------- -------- ---- ------ --- ------- ----- ghcr.io/openvoxproject/openbolt:latest 1 4 2 1 - 8 ghcr.io/openvoxproject/openvoxagent:latest - 7 58 7 2 74 ghcr.io/openvoxproject/openvoxdb:latest - 6 79 9 2 96 ghcr.io/openvoxproject/openvoxdb:latest-alpine - 1 - - - 1 ghcr.io/openvoxproject/openvoxserver:latest 2 49 634 100 4 789 ghcr.io/openvoxproject/openvoxserver:latest-alpine - 1 - - - 1 ghcr.io/voxpupuli/commitlint:latest 1 6 5 2 - 14 ghcr.io/voxpupuli/onceover:latest 1 4 2 1 - 8 ghcr.io/voxpupuli/r10k-webhook:latest 3 41 35 2 7 88 ghcr.io/voxpupuli/r10k:latest - 8 5 - 1 14 ghcr.io/voxpupuli/renovate:latest - 1 - - - 1 ghcr.io/voxpupuli/semantic-release:latest 1 6 8 2 - 17 ghcr.io/voxpupuli/voxbox:latest - - - - - - First published at: https://voxpupuli.org/blog/2026/08/07/container-statistics/